hxxp://nespesso[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/07/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://nespesso.com
Sample260701-e7a1aset7l

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4056	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273540798779621"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2684263265-1628758615-802431902-1000\{1F22DCF1-C905-4AFF-ABA4-41535FFFEC67}	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
5292	chrome.exe
5292	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe
Token: SeShutdownPrivilege	2060	chrome.exe
Token: SeCreatePagefilePrivilege	2060	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe
2060	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 4552	2060	chrome.exe	83
PID 2060 wrote to memory of 2732	2060	chrome.exe	84
PID 2060 wrote to memory of 2732	2060	chrome.exe	84
PID 2060 wrote to memory of 4056	2060	chrome.exe	85
PID 2060 wrote to memory of 5424	2060	chrome.exe	86
PID 2060 wrote to memory of 5424	2060	chrome.exe	86
PID 2060 wrote to memory of 472	2060	chrome.exe	88
PID 2060 wrote to memory of 1516	2060	chrome.exe	89
PID 2060 wrote to memory of 472	2060	chrome.exe	88
PID 2060 wrote to memory of 1516	2060	chrome.exe	89
PID 2060 wrote to memory of 5908	2060	chrome.exe	90
PID 2060 wrote to memory of 5908	2060	chrome.exe	90
PID 2060 wrote to memory of 5588	2060	chrome.exe	91
PID 2060 wrote to memory of 5588	2060	chrome.exe	91
PID 2060 wrote to memory of 1428	2060	chrome.exe	94
PID 2060 wrote to memory of 1428	2060	chrome.exe	94
PID 2060 wrote to memory of 3756	2060	chrome.exe	95
PID 2060 wrote to memory of 4084	2060	chrome.exe	96
PID 2060 wrote to memory of 4084	2060	chrome.exe	96
PID 2060 wrote to memory of 3140	2060	chrome.exe	100
PID 2060 wrote to memory of 4016	2060	chrome.exe	104
PID 2060 wrote to memory of 4016	2060	chrome.exe	104
PID 2060 wrote to memory of 3544	2060	chrome.exe	105
PID 2060 wrote to memory of 3544	2060	chrome.exe	105
PID 2060 wrote to memory of 4248	2060	chrome.exe	106
PID 2060 wrote to memory of 4248	2060	chrome.exe	106
PID 2060 wrote to memory of 2328	2060	chrome.exe	108
PID 2060 wrote to memory of 5348	2060	chrome.exe	109
PID 2060 wrote to memory of 1572	2060	chrome.exe	110
PID 2060 wrote to memory of 5100	2060	chrome.exe	111
PID 2060 wrote to memory of 5100	2060	chrome.exe	111
PID 2060 wrote to memory of 5292	2060	chrome.exe	112
PID 2060 wrote to memory of 1036	2060	chrome.exe	113
PID 2060 wrote to memory of 1036	2060	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://nespesso.com
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffbae41c728,0x7ffbae41c734,0x7ffbae41c740
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,13553660241224714056,3391402182822850163,262144 --field-trial-handle=2096,i,2911819488025015727,12150059521043415667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,13138297179486278075,7070556233028950607,524288 --field-trial-handle=2096,i,2911819488025015727,12150059521043415667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,6470895394868908876,10729800725410686333,524288 --field-trial-handle=2096,i,2911819488025015727,12150059521043415667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:5424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,14280391384875432215,15098402064685184217,2097152 --field-trial-handle=2096,i,2911819488025015727,12150059521043415667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,8188560540882594993,13668675992388409131,2097152 --field-trial-handle=2096,i,2911819488025015727,12150059521043415667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4408,i,3931378587074661346,14214534991973109729,2097152 --field-trial-handle=2096,i,2911819488025015727,12150059521043415667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4464 /prefetch:2
  2⤵
  PID:5908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4436,i,8577241131803642200,6969952338494752625,2097152 --field-trial-handle=2096,i,2911819488025015727,12150059521043415667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5004,i,16590359900609714175,1566459915685657526,2097152 --field-trial-handle=2096,i,2911819488025015727,12150059521043415667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5220,i,6376476037092452219,678791461076789291,524288 --field-trial-handle=2096,i,2911819488025015727,12150059521043415667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4948,i,6858716358267989195,14074972606461272230,524288 --field-trial-handle=2096,i,2911819488025015727,12150059521043415667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6176,i,8561929589327895069,14478857993466456899,524288 --field-trial-handle=2096,i,2911819488025015727,12150059521043415667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6184,i,8320590838556809119,18174359753173367009,2097152 --field-trial-handle=2096,i,2911819488025015727,12150059521043415667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3144,i,10459057632971328236,12236183734277293123,2097152 --field-trial-handle=2096,i,2911819488025015727,12150059521043415667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4884,i,17387687278983381049,10629555647817004656,2097152 --field-trial-handle=2096,i,2911819488025015727,12150059521043415667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,15259738838589952317,2978377501385364598,524288 --field-trial-handle=2096,i,2911819488025015727,12150059521043415667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4276,i,12288762291831851479,16144195942495369407,524288 --field-trial-handle=2096,i,2911819488025015727,12150059521043415667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3096,i,14066126280665987592,4695474864081837564,524288 --field-trial-handle=2096,i,2911819488025015727,12150059521043415667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4760,i,12892165650192092599,5345084387109781570,2097152 --field-trial-handle=2096,i,2911819488025015727,12150059521043415667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6180,i,6255051906160945734,2845719740511541041,262144 --field-trial-handle=2096,i,2911819488025015727,12150059521043415667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5556,i,2627631745309231554,15752928286070432607,2097152 --field-trial-handle=2096,i,2911819488025015727,12150059521043415667,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:1036

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 589b5000b593548376c0977da88d1f81fe907c00449982006a8c12a22d6c7630
MD5 2171dd96d7d2c17a94cdf2622547a423
SHA1 099d7adedfc86ed77499a85ca95719a481b61e9c
SHA512 39342655077bcb3ba19918cce255d07622f8f9916ba4127037451ddd9968041657a0401d8993ffd46a56b51bda56f7b674509971f4024498abaa9ac8789580d1
TLSH
T115E092A6C8619C2B1CFD4B69A551874AE74023673B41CD0B3A3E960C8FF16BA5585D2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 72a5c289910e43ab5b6a90aa617669da684582e9e5027d583c57235f89d875af
MD5 5c5e74847de3d4bf66c88ca9db206ca5
SHA1 1b80f0582de01f2d2af0ce1a1b7d37122666f318
SHA512 8da5da032129d04aea41595ca2c810568047e5bd3681c478531e6861165a06ace3d7d8b04484f7af8dd28a17c6750472a3f16209768c0db5f81e45ea31e45973
TLSH
T1F2B012EC0AD41001CF24C53025F1141512100C188023338381C340D2517F7D1C105188
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c8b26e7fb8692f2281504c5b99fdb9dfddbaae9b631854997143928424e54607
MD5 77bae58b0957d6a951c833e62446c644
SHA1 764d78f384dd70c6902f7b1b32459c8f6ab8afcc
SHA512 4a09b28d9719f4c1cbea0361abfb43b42e4590adef647de308cd95e9604f2d6c098e6e1061a53c275a161ac3d36b2e4b55c35c6f826cff60a9abc290f4ee5b8a
TLSH
T15641BDF793B4997E8A1192F4EA156E1FCE6D0524031C78A689D46E1B83F29B2E20074F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 42bd3ef2d490d9afd81d4928eb1a4f54d106202f7bf4b4661e5fbf1b51808b95
MD5 e703fca56e7f1a1504af844de6b03401
SHA1 6b8cf9aa4d711f0133d4cebf4d557fb5d612096f
SHA512 89c4112c6ee5e9c889468860019bfbb0abcc669696a713f7ddb789ba10581605b5eb61360a01036b9b88b59eed998a9ccc339b4c2e9855e9c5555d0bc6175137
SSDEEP 192:bRVnWvYWwWFbNt52W5qwDP0biOv7apAPRp2QVD49FHMVtb+WNnV1adVDma2+DxxK:bRSFbvtPQ+UXizmaH2iq2e
TLSH
T1A642C52EAA54697BACCFC229FE217753D7F6103561A11E84E6FC8A2C05E76CC312711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 fd7b96ea1eb9eb47749cb0c4eddcb8f2cc27022350d370006813d8a967deabaf
MD5 a9e7ac877ded6187c7fdccdfe214ebb6
SHA1 5946ef3c0564a440b7c1e8e9533fc288efdf455f
SHA512 722dd69d73a7dc21fedce8735c5f3d6e8df3f3bf75717c73cf450acf56b453aa0ce7f6cf0a43abd60b684bb78ff28bec1a9493d5cf5c6d1e53cedff9c2386c41
SSDEEP 192:bRVnWvYWwWFbNt52W5qwDP0bROv7apvbPRpWuJVJVD49FHMVdb+WNnV1aQVO6yVz:bRSFbvtPt+lX0zOaWA2Sq1E
TLSH
T17452B51AAA54697BACCFD229FA617B57D7F1203162A11E44E7FC8B2C02E76CC3127117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 951fab73bde2ce57805fa7eddb04c6a557b4ecca4f8fd2d83bd267e6579b5e62
MD5 0f78ca6a90b4e3e2d6850e38372cc19d
SHA1 c419bfa19f695ceda47644805ed4bd91df60ce99
SHA512 c1ec38068365e8a26f1901c0c633428822b963d905ca039227abc23cfa6423c2ffa6f2521a033f6ae4924914badead0441f089075766c8405b3d61776b4e3eaf
SSDEEP 192:bRVnWvYWwWFbNt52W5qwDP0b5Ov7apAPRp2JVJVD49FHMVgwb+WNnV1aQVO6yVDB:bRSFbvtPl+UXLzpsaWA2yq5E
TLSH
T18F52B52EAA54697BACCFD229FA217757E7F2203161A11E44E6FC8B2C01E75CC3127517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 28d839bcfb204efc07b4fd905c67b665b7ac963845fbb1076a952430e84c9580
MD5 623df45ab32f98fe9333da65db20fa6a
SHA1 3aca3990ec7e9c1a4e8ee01676e4e78ff050d667
SHA512 9d9f6980470a8d4379ef5581e62ff9365b414f4ab44aecf1494a184ca90b2d36d560d251cec4e66f08d691dc5901d526c1e9510e08775f0ff1ff876d77a77b50
SSDEEP 384:vNjzO7KxkXqKf/pUZNCgVLH2Hfgsl457pLuLcSjZkXODzq+ErU3p8L+HGyN423w3:vNzO7KxkXqKf/pUZNCgVLH2HfgsS57pz
TLSH
T1FE721A677C4C9A770F94C68CD8167F4FADB5025B61E9886443FA882903D5BCF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ecb2d7719b5f34277df1f9a1a594cce161cc6b98be6c6073c36ea6753d5eb09e
MD5 35bd842c8a8b0678b7767a49c0908296
SHA1 e56e1bdafad9eaff67a0f9eca5c5dd454051d374
SHA512 e52133b45f67c6550368f17e358fc169f0ef73227463172b9fe2540f85a0a70349e526ec38be70b321813b9027360ff2923488e42b65d95f16cc564ce363e19e
TLSH
T106B012C080026501C00702F411C358CC7514AF18961A270183E47972882915080150A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a284.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a284.TMP
Size 96B
SHA256 8693fadf0970414b57e5487713472a5b85483558bec8ebeb17265686bd7994a4
MD5 3c82c6ee19207f2a0f37f7f78361de87
SHA1 4a816b1dba60fd2a29ab422f837689387b87ea5a
SHA512 848380e7057a30b419f5de3742c9e4ca589a0bfcb0c4adf7db9d46f947b3a98426132fd94448d81933b05e6fadca1d1f3ccd951118b09b91bec6781dd4c5b775
TLSH
T177B02280E0032282C08203F828A0A2C830A0FF20C203220382E00AA3CC203380B20030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e57f109d6af6d214e0bdee51c0ff695f77b1c85fc9d98b22794fecca36d86667
MD5 5e3fd854e863209ad682d027f680048e
SHA1 ce78681e4a29b3bae7db45f19dbd3bc598457755
SHA512 b2739c0361a088fc58b3344671aff1bed37e68ae524609418d9424880c31c2e4b98ead6b9493aa6bc0ee1967681ca017b4d92d4cc32e9536dc196fc8871059e4
SSDEEP 3072:zFGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMn:4m7Rkm1tYpBeh2BAon
TLSH
T155C3022B9D75A93759B9BB0EB08E0A1F1DF149A7C930DA52C8D85B0433FA7C81A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 80c20309496a4d2412990f773af047cecc6540d71de40c6b9f0fec2c7753fd3f
MD5 b0b0e16ce06d3dc6293c8e689f0f6728
SHA1 7e090cc0f31a1aaac30673fcd300a115e0c7a57b
SHA512 0f38c4c9f476d81825d0b675e81a4a30bfbd256afe1620522119914fee39d5844c38e5536b955141f5640996cf114101348a4d3af05f523c187888f432a6a2ec
SSDEEP 3072:z0Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMn:Lm7Rkm1tYpBeh2BAon
TLSH
T177C312275D74A9375DB9BB4EB08F0B1F1EF149A7C920DE52C8D85B0423FA6CC1A49A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 6163e9c2db18588208386b7905e559a8114fcefc6418be5a8e32f8393baeb13b
MD5 d77928fd84c048dfa72fcec3adec6712
SHA1 264675322857318aa699549ea9ddd69bf525df4e
SHA512 3a7ca103a88d4adcc1852c2b9f2b0402bf372f79b492c434d7133130d74d01785f606e00f4009344cafa9e8b76e385785434c0eaa65c558135b7cf098a781f71
SSDEEP 3072:TOGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMn:1m7Rkm1tYpBeh2BAon
TLSH
T17FC312275E71A97B59B9BB4EB08E0B1F1EF149A2C930DE52C8D85B0437F97C81A48D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3679df8124369c786cc63653e2d78b59923bfac880b6b7924cd9fe6e00b05337
MD5 6df37d1d4644f1fb59d9e59567c8fa9b
SHA1 6cf1421c510653a3aaacd0e2187e65fd23929688
SHA512 245853531ea4fe5773e7c0839f965c985b3d31e597dc4afe6e33f327f1c9ab78f7224f64fe4ffb09bf5230e99828ce167acd554ca0c7d021eff889fd3fd82136
SSDEEP 3072:40Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMn:om7Rkm1tYpBeh2BAon
TLSH
T146C312275D74A9375DB9B74E708F0B1F1EF149A7C920DE52C8D85B0423F96CC1A49A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download